Contribute Open Script

Payload inspection sample 1: Do request payload match and replacement when url matches

by lix ‎04-01-2014 04:44 PM - edited ‎04-02-2014 03:46 PM (1,500 Views)

Tested with Brocade ServerIron ADX : Yes

Description :

if request url matches "index", ADX will inspect the request payload content. When any words in the payload matches patterns 'Stanford Digital Library', 'AOLs premium-video-services', 'The technology in RankDex would be patented and used later when Li founded Baidu in China.Convinced that the pages with the most', PAYLOAD_INSPECT_MATCHED event will be triggered, and matched patterns will be replaced by the target words.

 

 

use OS_SLB;
use OS_HTTP_REQUEST;
use OS_PAYLOAD_INSPECT;

sub HTTP_REQUEST {
    my $url = OS_HTTP_REQUEST::url;
    print "Request url is: $url\n";

 

    if ( $url =~ /index/ ) {
        OS_PAYLOAD_INSPECT::match(
            'Stanford Digital Library',
            'AOLs premium-video-services',
            'The technology in RankDex would be patented and used later when Li founded Baidu in China.Convinced that the pages with the most'
        );
    }
    OS_SLB::forward(111);
}

 

sub PAYLOAD_INSPECT_MATCHED {
    my $matString = OS_PAYLOAD_INSPECT::matched_str();
    my $matIndex = OS_PAYLOAD_INSPECT::matched_idx();


    print "\nMatched string ($matString) & Index is: $matIndex\n";

 

    OS_PAYLOAD_INSPECT::matched_replace(
        0, ' =============== REPLACED SMALL LENGTH STRING TO LARGE LENGTH STRING TO TEST - OPEN SCRIPT PAYLOAD INSPECT API =============== ',
        'free', ' @@@ FREE IS REPLACED AS LICENSE @@@ ',
        '', ' --- PAYLOAD INSPECT --- '
   );

 

}

Contributors